fix: at line 107 of ngx_stream_lua_log_ringbuf in...

[orbisai0security]

Summary

Fix critical severity security issue in src/ngx_stream_lua_log_ringbuf.c.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/ngx_stream_lua_log_ringbuf.c:107

Description: At line 107 of ngx_stream_lua_log_ringbuf.c, the function copies n bytes from a caller-supplied buffer into the ring buffer at the tail pointer using ngx_memcpy. There is no validation that n is less than or equal to the remaining capacity of the ring buffer (rb->end - rb->tail). If n exceeds the available space, the copy operation writes beyond the end of the allocated ring buffer, corrupting adjacent heap memory. This can overwrite heap metadata, function pointers, or other critical data structures managed by the nginx allocator.

Changes

• src/ngx_stream_lua_log_ringbuf.c

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security